ccfe3c53442581c74e964e606261ab3275f6a22133aa0179802b1f9ac308dbb5

Analysis

max time kernel
10s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 22:03

Target

2df947a5640338127b826de3bfd5b112_JaffaCakes118.pdf
Size

12KB
MD5

2df947a5640338127b826de3bfd5b112
SHA1

3168461852bcacc800a7960e86167d59f85247a4
SHA256

ccfe3c53442581c74e964e606261ab3275f6a22133aa0179802b1f9ac308dbb5
SHA512

089d4c3b0b6d6aa321daedbe6b50c684659588867d9435fd2d527b77617359fb82b250c5315cf3cffe510c19f4bc1aa878d923db72d8dbaf1fefd066bbed47d9
SSDEEP

192:bONbedw+lJ5PvfCY9TYqiyJLrisgm7/S3Sf1IqnIfsFS3SfUfWDAoMlJS3S3SUbz:bONbedw+lJ5XfCOYqTriiDv303

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2008	2520	WerFault.exe	29

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2008	2520	AcroRd32.exe	30
PID 2520 wrote to memory of 2008	2520	AcroRd32.exe	30
PID 2520 wrote to memory of 2008	2520	AcroRd32.exe	30
PID 2520 wrote to memory of 2008	2520	AcroRd32.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2df947a5640338127b826de3bfd5b112_JaffaCakes118.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 760
  2⤵
  - Program crash
  PID:2008

memory/2520-0-0x0000000002940000-0x00000000029B6000-memory.dmp

Filesize
472KB

Download